Research map / Adversarial robustness and security / Attacks on text and graphs
Hard to Forget: Poisoning Attacks on Certified Machine Unlearning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| poison training examples and then request their erasure | certified removal logistic regression · MNIST, Binary-MNIST, Fashion-MNIST, HAR | retrain interval: 71.6 -> 18.5; 132 -> 8.15; 119 -> 38.9; 42.2 -> 8.95 | Helped |
| increase regularization strength λ (ablation) | slow-down attack on certified removal · Binary-MNIST; σ=1 | retrain interval: 0.07 -> 48.4 | Hurt |
| increase objective perturbation magnitude σ (ablation) | slow-down attack on certified removal · Binary-MNIST; λ=10^-3 | retrain interval: 0.22 -> 8.15 | Hurt |
| tighten the ℓ1 perturbation bound from d/20 to d/200 (ablation) | slow-down attack · Binary-MNIST | retrain interval: 8.15 -> 72.3 | Hurt |
| use an ℓ1 perturbation constraint rather than an ℓ∞ constraint at comparable attack strengths (ablation) | slow-down attack · Binary-MNIST | retrain interval: ℓ1 d/20: 8.15; ℓ∞ 0.100: 48.9 | Mixed |
| replace GRNB cost with influence-norm cost (ablation) | slow-down attack · Binary-MNIST | retrain interval: 7.08 -> 8.15 | No clear effect |
| replace GRNB cost with gradient-norm cost (ablation) | slow-down attack · Binary-MNIST | retrain interval: 7.08 -> 19.21 | Hurt |
| ignore the model's dependence on poisoned data (ablation) | slow-down attack using GRNB cost · Binary-MNIST | retrain interval: 6.96 -> 7.08 | No clear effect |
| craft poison from surrogate data rather than defender training data (ablation) | slow-down attack · MNIST | retrain interval: 18.5 -> 19.0 | No clear effect |
| increase poisoning perturbation allowance (ablation) | slow-down attack · Binary-MNIST | retrain interval: ℓ∞ 0.100: 48.9; ℓ∞ 0.500: 5.63 | Helped |
Closest papers by meaning
- Backdoor Attacks via Machine Unlearning (AAAI 2024 · similarity 0.92)
- Reconstruction Attacks on Machine Unlearning: Simple Models are Vulnerable (NeurIPS 2024 · similarity 0.90)
- Machine Unlearning Fails to Remove Data Poisoning Attacks (ICLR 2025 · similarity 0.90)
- Forget to Flourish: Leveraging Machine-Unlearning on Pretrained Language Models for Privacy Leakage (AAAI 2025 · similarity 0.90)
- Certified Unlearning for Neural Networks (ICML 2025 · similarity 0.89)
- Layer Attack Unlearning: Fast and Accurate Machine Unlearning via Layer Level Attack and Knowledge Distillation (AAAI 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.